English translation for convenience. The German version is authoritative: Kundendoku (Deutsch). Also available in French.

Server-Exclusive Beta

Your protected BSP package, explained simply.

Server-Exclusive binds your protected Workshop BSP to a private server package. Map-relevant point/logic entities load only after a valid licence check. It is an additional protection layer, not absolute copy protection.

Which file belongs in the Workshop?

Only the protected *_server_exclusive.bsp from the ZIP. Never upload the unprotected original BSP. The licence file, entity JSON and both Lua scripts stay private on your authorised server. Without that package, extracted map content is not loaded.

How the protection works

1. Protect the BSPAudit, watermark, metadata cleanup and obfuscation (incl. brush removal) run first.
2. Get the packageYou receive the BSP, license.json, licence-check Lua, maploader Lua, entity JSON and installation notes as a ZIP.
3. Server checksOn map start, the Lua sends a signed licence check to bspmarket.de.
4. Licence validOn a valid response, configured doors, triggers or entities are activated.
5. Audit remainsLicence checks are stored in a technically traceable way, without raw IPs.

What goes where?

maps/<map>_server_exclusive.bsp -> Workshop and garrysmod/maps/

lua/autorun/server/*.lua -> garrysmod/lua/autorun/server/

data/bspmarket/*.json -> garrysmod/data/bspmarket/

What do I enter?

  • Server name: A readable note for you and support.
  • Server IP: Optional; stored only as a hash.
  • Workshop ID: Optional hint for your collection.
  • targetnames: Hammer names of doors, triggers or entities, one entry per line.

If you don't enter any targetnames

The map is still protected: fingerprint, audit, obfuscation (incl. brush removal), signed licence check and server package remain active. Without targetnames, however, the Lua cannot functionally restrict specific doors, triggers or entities.

Signatures & grace period

Active: The Lua signs requests with HMAC-SHA256 and verifies the signed server response. If bspmarket.de is briefly unreachable, the script uses the local grace cache until the configured period expires.

Limitation: The per-licence key resides in the server Lua. For live use we recommend a functional test first and then external Lua obfuscation, e.g. with your own obfuscation workflow.

What is not promised?